Cyber market softening sparks concern among brokers over risk controls

Brokers are warning that cyber insurance softening is threatening to undermine recent improvements in cyber risk management, which could leave companies exposed and ultimately turn the market once more. According to Marsh, global cyber insurance price increases moderated to just 1% in the second quarter of 2023, compared with 11% in Q1 and 28% in the fourth quarter of last year. A year ago, cyber insurance prices increased almost 83% in the first quarter and 36% in the second. “In terms of premium, we see stabilisation and a softer market, with some clients even experiencing decreases,” said Paulina Vélez Gómez, risk management cyber leader for Europe at the broker. Some clients experience double-digit decreases, depending on specific cases, she added. “In the last quarter, we saw premiums [in Europe] increase by an average of 6%, a different picture from previous quarters where we saw 17.5% in the first quarter 2023, 82.7% in the first quarter of 2022 and 35.6% in the second quarter of 2022. So we see [rate increases] are decreasing and we expect that trend to continue,” Vélez Gómez said. Cyber insurance rates have fallen “drastically” since the start of 2023, especially for excess layers, according to Nick Barker, head of Gallagher’s cyber practice in London. Rates applicable to well risk managed organisations are seeing flat to 10% decreases for primary, while excess layers have experienced reductions ranging from 15% to as high as 50%, with the median towards the lower banding, he said. Despite an increase in ransomware attacks, many insurers are continuing to grow their cyber books at present, explained Barker. “There are a lot of insurers at year end with potentially big targets to hit, which is why I think we are seeing rate decreases as carriers look to secure business. We only see increases at the moment for risks that are poorly managed from a security perspective, and where key security controls are missing, or where there has been claims activity,” said Barker. Competition among insurers is such that some are now more willing to underwrite companies with weaker cyber security, according to Barker. A year ago, many insurers were only underwriting risks that met strict risk management criteria, leaving some companies unable to buy cyber insurance. “The biggest sign that the soft market has arrived is the flexibility we are seeing on key security controls. Previously, if you did not meet minimum controls, you couldn’t buy cyber insurance. That has now shifted and we see increased flexibility from insurers around lesser security controls. We now see insurers willing to take on more risk and write those more exposed risks,” said Barker. “This is a big concern for the industry. Rate is one aspect, but one of the key drivers of claims is poor security controls… As an industry, we must not forget the lessons learnt in the tough times of the hard market,” he said. Capacity and competition has increased in Europe, with new players entering the cyber insurance market and as established insurers have resumed growth strategies, explained Vélez Gómez. “We have seen a bunch of new players, while insurers that offered maximum capacity in the hard market of €5m, are now giving €10m to €15m, and in some exceptions €20m to €25m… Some insurers that played only in the excess layers are now participating in lower or primary layers,” she said. The easing of market conditions goes beyond rate, with insurers now willing to discuss higher limits and retention levels. “We are now seeing limit movements. During the hard market, some clients restructured their programmes in terms of total limit and retention, but now they are slowly showing interest in buying more limit. Now the market has appetite and we can build big towers again,” said Vélez Gómez. Retentions are stable for large accounts and there are now opportunities to reduce retention levels for smaller risks, she continued. “We must learn from the hard market. Some clients are big enough to take larger retentions because cyber is an insurance that is there for severity and catastrophic losses. So our advice to large clients is, if you are comfortable with your retention levels, then keep them. But we have seen [with smaller] accounts, some clients want to reduce retentions and markets are open to do it,” she added. Competition in the cyber market has been rising following improved profitability from rate increases and the drop in ransomware claims last year, according to Barker. “At the end of last year, we started to see green shoots emerging and capacity potentially coming back into the market. Fast forward to 2023 and that market cycle has accelerated with new players frequently entering the market. Because of that competition, we have now seen rates drop substantially and coverage broadened as underwriters go after top-line growth strategies,” he said. “Following years of unprofitability for cyber insurers, 2022 was a unicorn year for underwriting, where rates were high and risk selection was good, and the claims environment had dropped off. So, from an underwriting performance perspective, it was a very positive year for insurers,” he added. However, the softening cyber insurance market has coincided with a recent uptick in ransomware attacks, and to a lesser degree, cyber insurance claims. While the cyber market enjoys an “easier trading environment”, rising claims activity and changing attack methods are a challenge for the market longer term, said Barker. He believes that the recent increase in ransomware claims will take time to filter through to insurer results, and therefore pricing. At the same time, much cybersecurity and incidence response has improved, he said. “Take ransomware as an example, clients have more sophisticated backup strategies and better early detection tools, which means they are picking up threats more quickly. Improved risk management means that while losses are still occurring, the impact on businesses is being contained in a far more sophisticated manner,” Barker said. He predicts that the cyber market will continue to soften for the rest of this year and into next year, but could see potential rate increases at the backend of next year and early 2025. That said, Barker does not expect a knee jerk reaction from insurers, but neither does he expect cyber insurance rates to return to previous lows. “We will not go back to where we were as a market in terms of how competitively priced cyber insurance was, because we now have actuarial data that drives minimum premium thresholds. While we are seeing rates drop, they will bottom out. But what we did see in the hard market was an overcorrection in terms of rate increases, and that is evidenced now as rates stabilise,” said Barker. And he did not rule out future underwriting criteria from insurers. “We are in a game of cat and mouse with threat actors, where the bad guys always seem to be one step ahead inventing new attack techniques. Insurers then react with updated security control requirements. Risk management should always come first, though, with insurance acting as a backstop. The focus for all organisations should be on risk management, understanding what is secure and managing data. Cyber risk management has never been so important,” said Barker.

Cyber market softening sparks concern among brokers over risk controls

Want to read this article?

Read Next

UK arenas face heightened terror threat, says Pool Re, as Martyn’s Law remains in draft form

Talanx ‘increasingly confident’ of beating full-year profit forecast on Q1 results

US property market stabilises but concern over casualty loss trends

AGCS’s revenue falls in Q1 as rate momentum slows

UK tells firms not to pay ransoms in cyberattacks

UK arenas face heightened terror threat, says Pool Re, as Martyn’s Law remains in draft form

Talanx ‘increasingly confident’ of beating full-year profit forecast on Q1 results

US property market stabilises but concern over casualty loss trends

AGCS’s revenue falls in Q1 as rate momentum slows

UK tells firms not to pay ransoms in cyberattacks

Want to read this article?

Read Next

UK arenas face heightened terror threat, says Pool Re, as Martyn’s Law remains in draft form

Talanx ‘increasingly confident’ of beating full-year profit forecast on Q1 results

US property market stabilises but concern over casualty loss trends

AGCS’s revenue falls in Q1 as rate momentum slows

UK tells firms not to pay ransoms in cyberattacks

Related Articles